Critical Flaw Allowed to Azure Cosmos DB Pwnage

A critical vulnerability in the Azure Cosmos DB database service could have allowed attackers to compromise all databases on the service, cybersecurity outfit Wiz reports.

Referred to as CosmosEscape, the security defect could have allowed an attacker to obtain a platform-wide key and retrieve the primary key of any Cosmos DB account, gaining full read and write access across the service.

Armed with the key, an attacker could have listed all databases on the service, filtering them by specific organization identifiers, such as subscription and tenant IDs.

“Chained together, these capabilities could have enabled precision targeting at platform scale: from identifying a specific organization’s databases to compromising them, all from publicly accessible endpoints,” Wiz says.

According to the cybersecurity firm, because Microsoft uses Cosmos DB to store data across Entra ID, Teams, and Copilot, the vulnerability potentially exposed the tech giant’s databases to unauthorized access.

The issue could have been exploited through the Gremlin API, a popular graph query language that relies on a custom Gremlin engine, compiling queries into .NET code that was executed in a sandbox.

Advertisement. Scroll to continue reading.

Pwning the sandbox

While the engine enforced restrictions to prevent access beyond Gremlin operations, it did not account for .NET reflection, which Wiz used to build arbitrary code execution primitives.

“By bypassing the Gremlin sandbox, we’ve gained code execution on the DB Gateway, a service that executes customer queries on their behalf, running on multi-tenant Service Fabric clusters,” Wiz explains.

The cybersecurity firm then discovered that the gateway was using a signing key to retrieve customer accounts’ primary keys and access their databases, and that the signing key worked across tenants, regions, and even APIs.

“It was a platform-wide key that could retrieve the primary key for any Cosmos DB account on the service, all through publicly accessible endpoints. We dubbed it the Cosmos Master Key,” Wiz notes.

Through the master key, the cybersecurity firm’s researchers could access a configuration store containing details on every Cosmos DB account, including names, subscription IDs, tenant IDs, and various other configuration data.

Pwning the databases

“The Config Store was itself a Cosmos DB database, meaning it could be queried with the full flexibility of CosmosDB’s SQL engine. It also meant that the Cosmos Master Key could retrieve its primary key – enabling attackers that exploited CosmosEscape to list all accounts in a region, or query by specific tenant ID to identify a specific organization’s databases,” the company explains.

An attacker with the master key and access to the configuration store could enumerate all Cosmos DB accounts, filter them, and retrieve a target’s primary key to gain full read and write access to all their databases.

According to Wiz, the attack could also be mounted against private and network-isolated Cosmos DB accounts, as well as Microsoft’s own databases.

Wiz reported the vulnerability to Microsoft in November 2025. Within two days, Microsoft deployed a hotfix to block the attack vector. In July, the tech giant completed the rollout of a long-term architectural fix across all regions.

“Microsoft conducted extensive reviews of access logs and found no evidence of unauthorized activity outside of the researcher’s testing activity, and no customer data was accessed. There is no customer action required,” the company said.

https://www.securityweek.com/critical-flaw-led-to-azure-cosmos-db-pwnage/

Product Spotlight on Mobile Security Solutions

Taelor Sutherland is the Associate Editor at Security magazine. Sutherland covers news affecting enterprise security leaders, from industry events to physical & cybersecurity threats and mitigation tactics. She is also responsible for coordinating and publishing web exclusives, multimedia content, social media posts, and a number of eMagazine departments. Sutherland graduated in 2022 with a BA in English Literature from Agnes Scott College.

https://www.securitymagazine.com/articles/102449-product-spotlight-on-mobile-security-solutions

CareCloud Data Breach Impacts Over 350,000

Healthcare information technology company CareCloud is notifying at least 350,000 people that their information was stolen in a data breach.

The incident involved an electronic health record environment within the CareCloud Health division, which was disrupted on March 16, 2026.

CareCloud’s investigation determined that hackers accessed one of its AWS environments between March 10 and March 16, and likely exfiltrated data from it.

On June 24, the investigation determined that personal, financial, and medical information was compromised in the incident, the company notes in the notification letter sent to the potentially affected individuals, a copy of which was filed with the Massachusetts Office of Consumer Affairs and Business Regulation.

The potentially affected information, it says, includes names, addresses, Social Security numbers, dates of birth, driver’s license numbers, government ID numbers, financial account numbers, credit/debit card numbers, and medical and health insurance information.

For a limited number of individuals, the compromised data also included full credit card information, including CVV, the company notes in an incident notification. CareCloud says it has no evidence that the stolen data has been misused.

Advertisement. Scroll to continue reading.

Based on filings with the Attorney General’s Offices in several states, at least 350,000 individuals have had their information stolen.

The company is providing them with up to 24 months of free identity theft protection, credit monitoring, and ID theft recovery services, which include a $1,000,000 insurance reimbursement policy.

“CareCloud engaged external cybersecurity experts and, with their assistance, secured the affected environment, eliminated the threat, and confirmed that no persistent unauthorized access remained. CareCloud is continuing to strengthen the security of its systems and environments,” the company says.

The healthcare organization has yet to share the total number of impacted individuals and details on the threat actor responsible for the attack. SecurityWeek has emailed CareCloud for additional details and will update this article if the company responds.

*Updated with additional information and link to CareCloud’s incident notice.

https://www.securityweek.com/carecloud-data-breach-impacts-over-350000/

Critical Code Execution Vulnerability Patched in TeamCity

JetBrains this week rolled out patches for a critical-severity vulnerability in TeamCity On-Premises that can be exploited without authentication.

Tracked as CVE-2026-63077 (CVSS score of 9.8), the security defect can be exploited via HTTP/S to bypass authentication and achieve remote code execution (RCE).

“An unauthenticated attacker could exploit the vulnerability via the TeamCity agent polling protocol to bypass authentication checks and execute arbitrary operating system commands with the privileges of the TeamCity server process,” JetBrains explains in its advisory.

Depending on the available privileges, an attacker could access TeamCity data, configurations, and credentials, could tamper with the server state, and could potentially compromise build artifacts and downstream CI/CD pipelines.

According to JetBrains, the flaw affects all TeamCity On-Premises versions. The company has already rolled out mitigations for TeamCity Cloud instances and has no evidence that the bug has been exploited in the wild.

“A fix for this vulnerability has been introduced in versions 2025.11.7 and 2026.1.3. We have also released a security patch plugin for 2017.1+ so that customers who are unable to upgrade can still patch their environments,” JetBrains announced.

Advertisement. Scroll to continue reading.

Users are advised to download and install either the latest version of TeamCity or the security patch plugin as soon as possible (the plugin resolves only this CVE, the company notes).

JetBrains also recommends limiting access to internet-facing TeamCity servers, running all servers with the minimum required operating system privileges, and using VPN connections or implementing additional protections to prevent unauthorized access.

“TeamCity servers should also run on dedicated hosts separate from build agents,” the company notes.

https://www.securityweek.com/critical-code-execution-vulnerability-patched-in-teamcity/

Why Security Fundamentals Still Matter in the Age of AI

When reports surfaced that Anthropic’s AI model, Mythos, could identify thousands of previously unknown vulnerabilities across critical software systems, the response was immediate. Regulators mobilized. Financial leaders convened emergency briefings. Headlines warned of a new era of cyber risk.

The concern is understandable, and the capabilities are significant. But the reality is that Mythos did not introduce an entirely new category of risk. AI has already been reshaping the cybersecurity landscape for years, making attacks faster, more scalable, and harder to detect; compressing the window between vulnerability disclosure and active exploitation from years to hours in some cases.

AI Is Accelerating Existing Threats

AI-powered cyberattacks did not begin with Mythos. Earlier-generation AI systems had already demonstrated the ability to identify vulnerabilities, automate reconnaissance, and improve phishing and social engineering attacks at scale.

What is changing now is the timeline. Vulnerability management teams used to have days or weeks to assess and remediate flaws. In some cases, automated scanning tools, increasingly augmented by AI, are probing the internet for newly disclosed vulnerabilities within hours or days of public identification. Organizations are racing against a clock that resets at the moment a CVE (Common Vulnerabilities and Exposures) goes public.

At the same time, AI is lowering the barrier to entry for attackers. Bad actors no longer need the same level of coding expertise to identify vulnerabilities and weaponize publicly disclosed flaws.

For phishing and social engineering attacks specifically, AI can help attackers create emails and messages that sound natural, polished, and personalized to the recipient. Instead of relying on obvious, generic scams, cybercriminals can produce convincing messages that are significantly harder to detect.

AI Still Exploits the Same Weaknesses

Despite the headlines, AI-driven attacks continue to rely on familiar security gaps: weak or shared credentials, missing multi-factor authentication (MFA), poor network segmentation, excessive access permissions, and unrestricted external connectivity

The attack methods may evolve, but the entry points are the same. In many cases, straightforward controls significantly reduce exposure. IP allowlisting, for example, can prevent entire categories of automated scanning and exploitation tools from ever reaching critical systems. These controls are well established. They still stop attacks when they’re implemented and maintained properly.

Yet, organizations continue to be compromised because those fundamentals are never fully implemented. That failure carries a higher price than it once did. Gaps that organizations previously had time to absorb are now critical exposures. Automated tools are scanning for and targeting newly disclosed vulnerabilities within hours of disclosure. The margin for incomplete compliance cyber hygiene has effectively disappeared.

Compliance Is a Security Strategy: Why PCI Still Matters

PCI DSS is built around the security controls that attackers continue to target. Those controls work because attackers still depend on the same security gaps to gain access. Its 300+ technical controls are intentionally rigorous, designed to reduce the likelihood and impact of exactly the kinds of attacks AI is now making easier to launch at scale.

There is a consistent pattern across major breaches. More often, the required controls were incomplete, inconsistently enforced, or treated as a compliance exercise instead of a security strategy. Research has shown that fully PCI-compliant organizations are far less likely to experience payment card data breaches.

Controls like network segmentation with strong access control, firewall configuration with default deny all loosened only to business necessary traffic, EDR, and least privilege remain highly effective against AI-augmented attacks because good security architecture anticipates how attackers operate, regardless of the tools they use. AI may be effective at network exploitation, but it’s not necessarily quiet, so detection is important.

The industry’s instinct will be to respond to AI threats with more AI tools. In many cases, that instinct is justified. Attackers are already using AI to find vulnerabilities faster. Defenders should be using it for the same reason. That does not mean replacing security discipline with another tool. It means using AI to pressure-test systems, find exposed assets, prioritize remediation and shorten the time between discovery and response. But it only helps if the basics are already in place. Access controls, segmentation, monitoring, patching and compliance still determine whether an attack becomes a breach.

What Organizations Should Prioritize Now

To strengthen defenses against AI-driven threats, organizations should focus less on the headlines and more on operational discipline by taking the following steps:

Conduct an honest assessment of PCI DSS compliance: Treat compliance as a real evaluation of where controls may have drifted, weakened or were never fully implemented. Pay particular attention to access controls, privileged account management, and network segmentation.
Tighten your vulnerability management program for the new timeline: Quarterly patching cycles are no longer sufficient when attackers can now exploit newly disclosed vulnerabilities within hours. Know every system and device in your environment. Anything you can’t see may be a vulnerability that attackers find first. Organizations should also evaluate where AI can help reduce the time between discovering a vulnerability and remediation.
Focus on the security gaps attackers target most often: Eliminate shared credentials, enforce strong password policies, implement multi-factor authentication consistently, and restrict network access to what is explicitly authorized for business purposes.
Take AI-augmented phishing seriously: Social engineering attacks are becoming more targeted and harder to identify as fraudulent. Employee awareness training and verification protocols need to reflect that reality.
Maintain Human Oversight and Expertise: AI can surface vulnerabilities faster, but organizations still require skilled people to validate the risk and decide how to respond.

AI shortened the time security teams have to respond. It has not replaced the need for strong security controls. Organizations that consistently execute the fundamentals will be better prepared for what comes next.

Mythos did not rewrite the principles of payment security. It made the consequences of ignoring them, or weak execution, far more immediate.

https://www.securitymagazine.com/articles/102417-why-security-fundamentals-still-matter-in-the-age-of-ai

CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs

The US Cybersecurity and Infrastructure Security Agency (CISA) is urging water and wastewater system (WWS) operators to protect operational technology (OT) against malicious activity targeting programmable logic controllers (PLCs).

The alert is a fresh call to action that comes just days after a coordinated cyberattack disrupted automated controls at dozens of water utilities in Minnesota.

In an alert published July 30, CISA said it is observing a significant increase in threat actors targeting PLCs in the water and wastewater sector, and urged critical infrastructure owners, operators, and integrators to remove publicly exposed PLCs and other OT from the internet as soon as possible.

The agency described specific tactics it has seen against exposed controllers: attackers have modified passwords to lock out operators and disconnected PLCs by changing their IP addresses. According to CISA, the attacks have resulted in “boil water notices” and sustained manual operations that closely mirror what several Minnesota utilities reported this week.

Notably, the alert stressed that the targeting spans water entities of all sizes, and that even organizations with mature cybersecurity programs should validate their external connections. CISA specifically called out cellular modems installed by operators, vendors, or system integrators that may not be documented or captured in routine attack surface scans.

Minnesota attacks underscore the warning

CISA’s renewed push follows a coordinated cyberattack that, according to Minnesota IT Services (MNIT), hit OT systems at more than 30 community water systems on July 26 and 27.

Advertisement. Scroll to continue reading.

As SecurityWeek reported earlier this week, statements from affected cities, including Maple Plain, Braham, South St. Paul, and Plymouth, indicated that some automated control functions were disrupted, though contingency procedures were activated and water and wastewater operations remained functional in most cases. The affected cities told residents that drinking water remained safe.

State and federal agencies are investigating, and no formal attribution has been made.

Ties to the Iranian PLC campaign

The timing of the Minnesota intrusions is notable. They came shortly after the US government warned critical infrastructure organizations about Iran-linked attacks on industrial control systems made by Siemens, Rockwell Automation, and Schneider Electric.

That warning came via a July 22 update to advisory AA26-097A, originally published in April, which expanded the list of targeted vendors beyond Rockwell Automation’s Allen-Bradley controllers to include Schneider Electric and Siemens devices, and noted that PLCs from other manufacturers may also be at risk. Investigators have observed activity against Rockwell CompactLogix and Micro850, Schneider Electric Modicon M340, and Siemens S7-1200 series PLCs.

Iranian threat groups including CyberAv3ngers and Handala fit the profile for attacks on water systems of the kind seen in Minnesota, though investigators have not linked the incidents to any specific actor. CyberAv3ngers has a long track record of targeting small water utilities and municipal facilities, and in 2020 attacks on water facilities in Israel, Iran-linked actors exploited vulnerable cellular routers as an entry point.

What OT operators should do

CISA’s core message to the sector is unchanged but increasingly urgent: internet-exposed OT must be secured. The July 30 alert recommends three immediate steps. Operators should disconnect the PLC from the internet, routing any remote access for operational purposes through a VPN or gateway device rather than directly to the controller; enable password protection and change default passwords; and allowlist IP addresses so that remote access is permitted only from known engineering laptops or other critical OT assets.

CISA also advised that, after disconnecting PLCs, operators ensure they have a known-clean backup of the PLC image in case they are locked out by a modified password. Owners and operators of Rockwell Automation MicroLogix 1400 controllers are pointed to Rockwell’s dedicated guidance for restoring access when the password is unknown.

Beyond the immediate steps, utilities are encouraged to review the tactics, techniques, and indicators of compromise in AA26-097A for signs of current or historical activity on their networks. For more information, read the full alert from CISA.

Learn More at the ICS Cybersecurity Conference | Nashville

https://www.securityweek.com/cisa-urges-water-sector-to-protect-ot-after-coordinated-attacks-on-plcs/

Bank of America to Acquire Cybersecurity Firm MDSec

Bank of America announced on Thursday that it plans to acquire UK-based information security consultancy MDSec Consulting Limited.

Headquartered in Macclesfield, England, MDSec provides technical information security consulting services and employs approximately 65 cybersecurity professionals.

The acquisition will expand Charlotte, North Carolina-based Bank of America’s existing presence in northern England. The financial institution has more than 1,400 employees in nearby Chester, where it also operates a cyber threat operations center.

“We have long admired the exceptional ability of the MDSec team and are delighted that Bank of America and its clients will now further benefit from their work,” said Bank of America chief information security officer Kris Fador.

MDSec co-founder Dominic Chell said joining Bank of America would allow the company to further its efforts to develop security capabilities and advance technical innovation.

“Joining one of the world’s leading financial institutions, one that reflects our culture of innovation and technical excellence, gives us an incredible opportunity to take that ambition to the next level,” Chell said.

Advertisement. Scroll to continue reading.

The transaction is expected to close during the fourth quarter of 2026, subject to regulatory approvals. Financial terms were not disclosed.

https://www.securityweek.com/bank-of-america-to-acquire-cybersecurity-firm-mdsec/

Okta to Acquire Identity Threat Detection Firm Permiso

Okta on Thursday said it has signed a definitive agreement to acquire Permiso Security, a cloud-native identity security platform that specializes in detecting and mitigating threats across human, non-human, and agentic identities in multi-cloud environments. The deal extends Okta’s reach beyond identity management and into the realm of security operations, positioning the company to compete more directly on identity threat detection and response (ITDR).

Once folded into Okta’s identity security fabric, Permiso’s technology is expected to help organizations close operational blind spots and extend runtime detection and response across every type of identity in their environment.

“We’re thrilled to welcome Permiso to Okta as we help companies secure their agentic enterprises where humans, applications, service accounts, and AI agents work together,” said Ely Kahn, Chief Product Officer at Okta. He added that Permiso brings “proven identity threat detection and response capabilities, and an incredible threat research and security team that will advance Okta’s threat detection and prevention capabilities.”

Following the close of the transaction, Okta plans to unify identity threat detection and identity posture management into a single security offering, built around several capabilities inherited from Permiso.

Expanding Into the Security Operations Center

Beyond product features, the acquisition is expected to expand Okta’s footprint into the core Security Operations Center (SOC), giving the company a stronger foothold to partner with enterprise CISOs on evolving SecOps challenges. Permiso’s threat research arm, P0 Labs, will be folded into Okta’s research capabilities, adding post-authentication insight into suspicious behavior across cloud and AI environments. Combined with Okta’s existing threat intelligence operation, the company says this will strengthen detections, threat hunting, and its product roadmap across the identity lifecycle.

Deal Terms

The transaction is expected to close in the third quarter of Okta’s fiscal year 2027, subject to customary closing conditions. Okta said the deal is not expected to affect the financial guidance it issued on May 27, 2026. Financial terms of the acquisition were not disclosed

Advertisement. Scroll to continue reading.

https://www.securityweek.com/okta-to-acquire-identity-threat-detection-firm-permiso/

AI Governance Is the New Security Baseline

Artificial intelligence is no longer experimental inside the enterprise, and neither should be the governance surrounding it.

AI adoption is now embedded into workflows and influencing decisions. Agentic AI is also on the rise, and according to Cyber Security Tribe’s 2026 Annual State of the Industry Report, nearly three-quarters of cybersecurity practitioners report using or actively developing agentic AI within their cybersecurity programs.

However, governance is still catching up. AI governance is the framework of policies, processes, and oversight mechanisms organizations put into place to ensure AI systems are developed and used ethically, legally, safely, and transparently. And while 70% of organizations now have AI policies in place, the report shows that AI policy strictness averages 6.7 out of 10, reflecting a tension: controls must be strong enough to prevent data exposure and misuse, yet flexible enough to allow for innovation and avoid driving users toward unsanctioned tools.

This balancing act is defining the next phase of enterprise AI.

From Visibility Gaps to AI Sprawl

Fragmentation is a consistent concern among cybersecurity leaders. Employees access AI tools through web applications, browser extensions, desktop software, APIs, and increasingly through autonomous agents capable of interacting with other systems. Business units experiment independently, employees adopt preferred tools, and organizations rapidly introduce new models.

The result is AI sprawl: a distributed, fast-moving surface area that stretches across web and endpoint environments at a pace few governance processes were designed to accommodate.

Traditional security architectures were not designed for this reality, either. Point solutions often introduce complexity and sacrifice unified control. Network-based inspection lacks full visibility into encrypted browser sessions. API integrations provide partial visibility, but they miss user-level interactions at the presentation layer.

What remains largely unaddressed is governance at the point where humans and AI actually interact: the session itself. Without visibility and control at that interaction layer, organizations are left reconstructing intent after the fact rather than shaping behavior in real time.

And the proliferation of agentic AI is only expanding the risk model. Autonomous systems rely on data quality, model reliability, and defined permission boundaries. If inputs are flawed or guardrails are insufficient, automation can amplify errors at machine speed. Other risks include over-automation, compliance gaps, and a lack of auditability around AI-driven actions.

Governance As Enablement, Not Friction

The challenge for leaders is how to embrace AI without eroding control. While early AI governance concerns chiefly surrounded preventing data leakage into public models, today’s enterprise AI governance must address agent permissions, accountability, autonomous tool execution, the boundary between enterprise data and foundation models, and more.

This requires embedding operational guardrails into daily workflows. That might include:

Clear scoping of approved use cases by risk tier.
Defined data handling rules aligned to data classification standards.
Role-based access to AI tools and agents.
Comprehensive logging of prompts, outputs, and tool actions.
Continuous monitoring rather than periodic reviews.

Just as cybersecurity frameworks have evolved from “paper compliance” to measurable control effectiveness, AI governance must move from theoretical acceptable-use statements to dynamic, enforceable controls.

Further, these frameworks deliver the most value when they serve as a shared language between security, IT, and the board. AI governance must translate technical behavior into business risk terms: revenue impact, regulatory exposure, operational continuity, and customer trust.

The False Choice of AI Risk

The 2026 data suggests we are at a turning point. Most organizations have AI policies, many are deploying agents, and boards increasingly recognize cyber risk. But while AI is embedded, governance maturity varies widely.

That’s partially because, too often, enterprises frame AI risk as a binary: block risky tools or tolerate uncertainty. But it’s a false choice. Enterprises don’t have to sacrifice innovation for control.

AI governance models must prioritize visibility, consistent policy enforcement, and controls that move with the user across environments. As AI becomes embedded across browsers, SaaS platforms, and autonomous agents, governance can no longer be fragmented or point-in-time. It needs to operate wherever AI interactions occur. If AI is becoming the primary interface to enterprise systems and data, governance must be designed to operate just as seamlessly at that same layer.

No longer is adoption the yardstick by which we measure enterprise AI maturity. In 2026, responsible control of AI is the new baseline.

https://www.securitymagazine.com/articles/102416-ai-governance-is-the-new-security-baseline

Doing More with Less: Practical Security Solutions for Resource Strapped Schools

With school buildings averaging nearly 50 years old nationwide, many districts may struggle with deteriorating facilities, outdated infrastructure, or insufficient technology. Budgets are stretched with varying priorities, yet safety threats continue to grow, challenging schools to strengthen their security posture using the resources they have on hand. By focusing on foundational, code-compliant practices and operational discipline, schools can significantly enhance safety in practical, cost-effective ways.

Facility Maintenance

A critical first step is ensuring all facilities are well maintained. Offering clean, orderly and visibly cared-for environments helps reduce the opportunity for vandalism and discourages unsafe and unauthorized activity on school grounds. Enhancements, such as additional windows or improved lighting in darker places inside the building and exterior areas, can increase visibility by eliminating blind spots and supporting natural surveillance, which are key components to a safer campus.

Clear Procedures

Operational consistency is especially important when keeping a school safe. Aging physical infrastructure and manual processes can introduce vulnerabilities if daily procedures are not followed rigorously. Schools manage a wide range of individuals throughout the year who each require different areas of access – including contractors, substitutes and volunteers. Without clear protocols for granting and monitoring access, the risk of unauthorized entry increases. Simple habits, such as ensuring classroom and office doors are secured at all times, are low-cost practices that help strengthen internal security of the school.

Having strong key control and access management practices in place provides another layer of protection for the school without requiring advanced technology. Establishing a well-defined key procedure for issuing, tracking and retrieving keys helps ensure only authorized individuals can access specific areas. By having strong key tracking practices in place, schools can hold an accountability system, allowing them to proactively identify gaps before they potentially become security incidents.

Visitor management is another essential area schools must pay close attention to, and often a very overlooked layer of security. Offering a single, secured point of entry for visitors helps control who is entering and leaving the building. Visitor identity verification and a clear pre-approved entry protocol help prevent unauthorized pickups or entry attempts. While having strong internal hardware limits access internally, strong visitor management helps control the external perimeter, a critical component of the overall safety of the campus.

Building a Culture of Safety

In addition to physical and operational improvements, a strong culture of safety can be equally impactful. Encouraging participation in regular training can help everyone understand their role in maintaining a secure environment. Regular training can range from recognizing unusual behavior and knowing how to respond during various emergency situations. Simple daily procedures like verifying doors are closed and locked, confirming visitor protocols are being followed, and identifying areas where student behavior may indicate risk reinforce strong safety habits. When consistent, these simple habits can become very effective. When students and staff understand safety protocols and expectations, districts can create a proactive environment where issues are spotted early and addressed quickly, helping strengthen overall safety.

As the most widely recognized national framework K-12 physical security, the Partner Alliance for Safer Schools (PASS) provides clear, tiered guidelines that help districts implement effective, code-compliant measures based on their current resources and facility needs. PASS guidelines emphasize the importance of classroom door locking from the inside only, so no individual must step into the hallway.

Beyond door security, PASS also highlights the importance of accessible communication tools. Staff should be able to easily reach a telephone, panic button, intercom call button or two-way radio to alert administrators or first responders when help is needed.

Lastly, a comprehensive Emergency Operations Plan (EOP) is an essential component and conducting safety drills throughout the year will strengthen preparedness. Schools that gather feedback from students and staff after drills take place can uncover pain points, make adjustments and strengthen procedures.

By implementing low-cost initiatives, districts can take important steps toward creating a safer, more resilient learning environment. This includes prioritizing facility upkeep, improving operational discipline, strengthening access control and enhancing classroom readiness. With thoughtful planning and consistent execution, schools can make meaningful progress toward strengthening their security posture, while building a strong foundation for future safety investments.

https://www.securitymagazine.com/articles/102412-doing-more-with-less-practical-security-solutions-for-resource-strapped-schools